{"id":229334,"date":"2025-07-30T13:54:50","date_gmt":"2025-07-30T11:54:50","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=229334"},"modified":"2025-10-21T11:50:17","modified_gmt":"2025-10-21T11:50:17","slug":"shadow-syndicate-infrastructure-illumination","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/shadow-syndicate-infrastructure-illumination\/","title":{"rendered":"Shadow syndicate infrastructure illumination"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"229334\" class=\"elementor elementor-229334\" data-elementor-settings=\"{&quot;element_pack_global_tooltip_width&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_padding&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true}}\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-12cebe4b e-flex e-con-boxed e-con e-parent\" data-id=\"12cebe4b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-431cb094 elementor-widget elementor-widget-text-editor\" data-id=\"431cb094\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h4>Key findings<\/h4>\n<p>We found a new heuristic allowing us to keep tracking the attack infrastructure of the infamous ShadowSyndicate known to leverage a wide range of top-tier Ransomware-as-service.<\/p>\n<ul>\n<li>ShadowSyndicate used the same Secure Shell (SSH) fingerprint on many servers (138 at the time of writing). It matches a previous TTP reported by GroupIB in September 2023<\/li>\n<li>ShadowSyndicate works with numerous ransomware groups and affiliates of ransomware programs including RansomHub<\/li>\n<li>We found connections between ShadowSyndicate infrastructure and Cl0p\/Truebot substantiating previous findings of GroupIB<\/li>\n<li>We found connections between ShadowSyndicate infrastructure and Citrix Bleed attack infrastructure that spread Lockbit ransomware<\/li>\n<li>We assess with moderate confidence that ShadowSyndicate has access to a network of private bulletproof hosts (BPHs) in Europe that exhibit traits of Intelligence Agencies hosting (IAH)<\/li>\n<li>The global resilience against takedowns is ensured via a high level of imbrication of those BPHs, registered in offshore jurisdiction, spanning different countries but operated from Russia. We found links of interests with the Kremlin for some of them<\/li>\n<li>BPHs are blurring lines by appearing as VDS | VPS | VPN | (residential) proxy platforms and even sometimes an additional obfuscation layer via a DDOS protection provider<\/li>\n<li>With lower confidence, we found a hack and leak operation targeting Hunter Biden, the son of the former President of the United States, seeking to influence 2024 presidential elections. The goal is to weaken representative governments perceived as democracies and weaken unaligned candidates with the Kremlin&#039;s interests. Using proxies such as ransomware programs and\/or an IAB shields from prosecution in return for \u201cplausible deniability for state-backed cyber operations<\/li>\n<li>We found connections between ShadowSyndicate infrastructure and Amos Stealer infrastructure (moderate confidence) as well as though with lower confidence, with ToneShell backdoor<\/li>\n<\/ul>\n<p><strong>As of this writing, the attack infrastructure remains active, with threat actors continuously scanning for vulnerabilities and distributing new malicious payloads to victims.<\/strong><\/p>\n<p>We would like to express our sincere appreciation for our collaboration with <a href=\"https:\/\/www.group-ib.com\/\">Group-IB<\/a>, for their peer reviewing, insightful discussions, and valuable contributions. The opportunity to cross-correlate data using their telemetry has been especially valuable, enabling us to validate findings and enhance the overall accuracy and depth of our analysis. This partnership underscores the importance of collective intelligence in tackling today&#039;s complex threat landscape.<\/p>\n<p>NB Names of persons and organizations within this presentation are included for completeness. No implication of guilt or association should be implied.<\/p>\n<h5>Introduction<\/h5>\n<p>ShadowSyndicate (aka Infra Storm <a href=\"https:\/\/www.group-ib.com\/blog\/shadowsyndicate-raas\/\">GroupIB<\/a>) is a recent intrusion set reportedly active since July 2022. It has demonstrated the use of multiple top tier <strong>Ransomware-as-a-Service<\/strong> (RaaS) brands such as <strong>AlphaV\/Blackcat, Lockbit, Play, Royal, Cl0p, Cactus and Ransomhub<\/strong>. GroupIB in 2023 conjectured that <strong>ShadowSyndicate<\/strong> is more likely a <strong>new Ransomware-as-a-Service<\/strong> (RaaS) affiliate rather than an <strong>Initial access broker<\/strong> (IAB).<\/p>\n<p>Overlaps were also found with <strong>TrickBot, Ryuk\/Conti, FIN7<\/strong>, and <a href=\"https:\/\/thehackernews.com\/2023\/06\/alarming-surge-in-truebot-activity.html\">TrueBot<\/a> (also known as <a href=\"https:\/\/malpedia.caad.fkie.fraunhofer.de\/details\/win.silence\">Silence.Downloader<\/a>) malware operations (linked to the <strong>Silence group<\/strong> <a href=\"https:\/\/thehackernews.com\/2023\/06\/alarming-surge-in-truebot-activity.html\">overlapping<\/a> <strong>Russian intrusion set Evil Corp<\/strong> <a href=\"https:\/\/www.nationalcrimeagency.gov.uk\/who-we-are\/publications\/732-evil-corp-behind-the-screens\/file\">directed by FSB<\/a> to conduct cyber espionage against NATO allies).<\/p>\n<p style=\"text-align: justify;\"><a href=\"\/en\/#_ftnref3\" name=\"_ftn3\"><\/a><a href=\"\/en\/#_ftnref4\" name=\"_ftn4\"><\/a><\/p>\n<p>\u00a0<\/p>\n<h4>Intrinsec&#039;s CTI services<\/h4>\n<p style=\"text-align: justify;\">Organizations are facing a rise in the sophistication of threat actors and intrusion sets. To address these evolving threats, it is now necessary to take a proactive approach in the detection and analysis of any element deemed malicious. Such a hands-on approach allows companies to anticipate, or at least react as quickly as possible to the compromises they face.<\/p>\n<p style=\"text-align: justify;\">For this report, shared with our clients in January 2025, Intrinsec relied on its Cyber Threat Intelligence service, which provides its customers with high value-added, contextualized and actionable intelligence to understand and contain cyber threats. Our CTI team consolidates data &amp; information gathered from our security monitoring services (SOC, MDR, etc.), our incident response team (CERT-Intrinsec) and custom cyber intelligence generated by our analysts using custom heuristics, honeypots, hunting, reverse-engineering &amp; pivots.<\/p>\n<p style=\"text-align: justify;\">Intrinsec also offers various services around Cyber Threat Intelligence:<\/p>\n<ul style=\"text-align: justify;\">\n<li>Risk anticipation: which can be leveraged to continuously adapt the detection &amp; response capabilities of our clients&#039; existing tools (EDR, XDR, SIEM, \u2026) through:\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><strong>an operational feed of IOCs based on our exclusive activities.<\/strong><\/li>\n<li><strong>threat intel notes &amp; reports, TIP-compliant.<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>Digital risk monitoring:\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><strong>data leak detection &amp; remediation<\/strong><\/li>\n<li><strong>external asset security monitoring (EASM)<\/strong><\/li>\n<li><strong>brand protection<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Follow us on <a href=\"https:\/\/www.linkedin.com\/company\/intrinsec\/\">LinkedIn<\/a> and <a href=\"https:\/\/twitter.com\/Intrinsec\">X<\/a><\/p>\n\n<p>\u00a0<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3916f9b elementor-widget elementor-widget-button\" data-id=\"3916f9b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/10\/TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Download the full report content<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Key findings We found a new heuristic allowing us to keep tracking the attack infrastructure [\u2026]<\/p>","protected":false},"author":1,"featured_media":229529,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,11],"tags":[],"class_list":["post-229334","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threat-intelligence","category-threat-intelligence-report"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Shadow syndicate infrastructure illumination - INTRINSEC<\/title>\n<meta name=\"description\" content=\"Analysez l&#039;infrastructure du Shadow Syndicate et d\u00e9couvrez comment elle relie diff\u00e9rents ran\u00e7ongiciels et attaques.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/shadow-syndicate-infrastructure-illumination\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Shadow syndicate infrastructure illumination\" \/>\n<meta property=\"og:description\" content=\"Analysez l&#039;infrastructure du Shadow Syndicate et d\u00e9couvrez comment elle relie diff\u00e9rents ran\u00e7ongiciels et attaques.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/shadow-syndicate-infrastructure-illumination\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-30T11:54:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-21T11:50:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/07\/Template-banner-webesite-10.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Intrinsec\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Intrinsec\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/\"},\"author\":{\"name\":\"Intrinsec\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/ade590fbc7ad6f413727bae7cd3fb799\"},\"headline\":\"Shadow syndicate infrastructure illumination\",\"datePublished\":\"2025-07-30T11:54:50+00:00\",\"dateModified\":\"2025-10-21T11:50:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/\"},\"wordCount\":698,\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/Template-banner-webesite-10.png\",\"articleSection\":[\"Cyber Threat Intelligence\",\"Threat Intelligence Report\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/\",\"name\":\"Shadow syndicate infrastructure illumination - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/Template-banner-webesite-10.png\",\"datePublished\":\"2025-07-30T11:54:50+00:00\",\"dateModified\":\"2025-10-21T11:50:17+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/ade590fbc7ad6f413727bae7cd3fb799\"},\"description\":\"Analysez l'infrastructure du Shadow Syndicate et d\u00e9couvrez comment elle relie diff\u00e9rents ran\u00e7ongiciels et attaques.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/Template-banner-webesite-10.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/Template-banner-webesite-10.png\",\"width\":1200,\"height\":600,\"caption\":\"Shadow syndicate infrastructure illumination\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/shadow-syndicate-infrastructure-illumination\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Shadow syndicate infrastructure illumination\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/ade590fbc7ad6f413727bae7cd3fb799\",\"name\":\"Intrinsec\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"caption\":\"Intrinsec\"},\"sameAs\":[\"https:\\\/\\\/www.intrinsec.com\"],\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/ufhtbqccsz\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Shadow union infrastructure illumination - INTRINSEC","description":"Analyze the Shadow Syndicate infrastructure and discover how it connects different ransomware and attacks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/shadow-syndicate-infrastructure-illumination\/","og_locale":"en_US","og_type":"article","og_title":"Shadow syndicate infrastructure illumination","og_description":"Analysez l'infrastructure du Shadow Syndicate et d\u00e9couvrez comment elle relie diff\u00e9rents ran\u00e7ongiciels et attaques.","og_url":"https:\/\/www.intrinsec.com\/en\/shadow-syndicate-infrastructure-illumination\/","og_site_name":"INTRINSEC","article_published_time":"2025-07-30T11:54:50+00:00","article_modified_time":"2025-10-21T11:50:17+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/07\/Template-banner-webesite-10.png","type":"image\/png"}],"author":"Intrinsec","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Intrinsec","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/"},"author":{"name":"Intrinsec","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/ade590fbc7ad6f413727bae7cd3fb799"},"headline":"Shadow syndicate infrastructure illumination","datePublished":"2025-07-30T11:54:50+00:00","dateModified":"2025-10-21T11:50:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/"},"wordCount":698,"image":{"@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/07\/Template-banner-webesite-10.png","articleSection":["Cyber Threat Intelligence","Threat Intelligence Report"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/","url":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/","name":"Shadow union infrastructure illumination - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/07\/Template-banner-webesite-10.png","datePublished":"2025-07-30T11:54:50+00:00","dateModified":"2025-10-21T11:50:17+00:00","author":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/ade590fbc7ad6f413727bae7cd3fb799"},"description":"Analyze the Shadow Syndicate infrastructure and discover how it connects different ransomware and attacks.","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/07\/Template-banner-webesite-10.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/07\/Template-banner-webesite-10.png","width":1200,"height":600,"caption":"Shadow syndicate infrastructure illumination"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/shadow-syndicate-infrastructure-illumination\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"Shadow syndicate infrastructure illumination"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/ade590fbc7ad6f413727bae7cd3fb799","name":"Intrinsic","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","caption":"Intrinsec"},"sameAs":["https:\/\/www.intrinsec.com"],"url":"https:\/\/www.intrinsec.com\/en\/author\/ufhtbqccsz\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/229334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=229334"}],"version-history":[{"count":7,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/229334\/revisions"}],"predecessor-version":[{"id":230371,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/229334\/revisions\/230371"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media\/229529"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=229334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=229334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=229334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}